In a recent data breach incident, a Saudi hacker defaced a prominent sports news web site in Israel and linked its front page to a file exposing the details of many credit card numbers of Israeli citizens.

The incident by itself is not very significant in terms of data security and does not demonstrate any significant technology advancement. The list of cards and personal details were probably not directly obtained by the Saudi hacker.

It appears that these lists have been circulating around for quite some time - compiled from various Israeli applications that were broken into. In fact, some of the individuals whose details appeared in the list mentioned that their account showed weird activities already two months ago. The format and structure of the files, discussions from hacker forums and press publications indicate the hackers used mainly SQL Injection.

Interesting to note is that this breach indicates that merchants involved in the incident were anything but PCI compliant.

However, the really interesting aspect to this story is the opportunities this incident created for attackers. One of the immediate effects of the breach is that people in Israel rushed over to the web to check whether they are in the list.

This created a wonderful opportunity for attackers of all kinds to promote their business by posting fake links to “the file”. These links, promoted through black hat search optimization, are part of either click fraud campaigns or malware infection schemes.

Other quick entrepreneurs posted web applications which allow people to check whether their name is in the file by supplying their email (some of these are actually legit applications posted by security researchers) and Israeli ID number (clearly not legit). This is of course just a preface to the true problem coming: phishing campaigns and phone scams that are sure follow.

In the next few days, we expect a deluge of e-mails, allegedly from the credit issuer that calls for some information disclosure on the part of the recipient as part of an “account restitution” procedure.

One last anecdotal effect is that the online account management application for the Israeli issuer was displaying apparent slowdown throughout the day, to the point that it was almost not providing service – that’s what I call crowd sourcing DDoS.


Author: Amichai Shulman, CTO and Co-founder of Imperva.